Data mapping software that tests your record of processing against what your systems really do, every week
Your record of processing matches what systems really do, checked every week, signed.
See one case, screen by screen ↓Data Mapping and ROPA is data mapping software for privacy teams that builds the record of processing activities from real systems and contracts and keeps it true. Eight agents read your systems, tags and contracts, test every activity's record against them every week, and draft cited corrections; process owners confirm, and the DPO approves and signs the Article 30 record.
How to choose AI solutions for back-office and enterprise work →
Updated
Article 30 requires a controller to keep a written record of its processing activities — purposes, data subjects, data categories, recipients, third-country transfers, erasure time limits and security measures — available to the supervisory authority on request. In most enterprises that record is a spreadsheet built once a year from interviews and a long survey per activity. At the demo company, Kestrel & Vane Group, the March 2026 review took 11 weeks, 61 owners and a 58-question survey per activity.
Then the systems move on and the record does not. A release adds a date-of-birth field to a signup form; an agency publishes a pixel that sends hashed emails to a US vendor; marketing signs an order form whose data processing terms are "in Schedule 3", which is not attached. No survey asks about it until next year. When the agents first compared the signed record with the systems, 119 of 412 activities did not match — and a wrong record means an access request that misses a system, a breach notice that cannot say whose data was at the vendor, and a DPIA screening that never triggers.
Estimated split of the demo company's 11-week annual review (March 2026), by hand, and of the same work in one quarterly cycle with the solution.
Eight agents discover, compare, draft and check each other; owners confirm and the DPO signs.
Kestrel & Vane Services B.V. sends a monthly newsletter to 184,300 subscribers. Its record, MKT-007 version 6, was confirmed by its owner on 18 June. In October the systems behind it changed. Here is what happens next, screen by screen, in the working solution.
Overnight the agents read 214 connected systems and found 4 changes. Ana's home screen counts 361 activities in sync, 23 drifted and 28 unconfirmed, and 7 that need her. At the top: the newsletter now collects date of birth and sends data to a new US vendor, and Owen Pryce has until Mon 19 Oct to confirm.
Reconciler and transfer checker: “The newsletter record no longer matches its systems.”
Every activity is one row — data subjects, data categories, systems, recipients, transfers, retention, lawful basis — tested against its systems and contracts every week. Where reality differs, a marker sits in the cell itself. On MKT-007: “+ date of birth”, “+ Lumenvale Analytics” and “+ US · no mechanism”, where the register says no transfers outside the EEA.
“A marker shows what the systems do that the register does not say; click it for the evidence.”
The activity opens field by field, Article 30(1)(a) to (g) and the lawful basis: what the register says on the left, what the systems show on the right. Since Thu 8 Oct the signup form requires date of birth, now on 2,870 records; a pixel in tag manager container v118 sends hashed email, IP address and device ID to Virginia. Ana asks the agents whether the pixel fires before consent.
Discovery agent: “Yes. Tag 41 fires on page view with no consent condition, so the pixel runs before the visitor chooses in the cookie banner.”
Each citation opens the passage the agent read. The contract reader found Lumenvale's order form CR-7731: hosting in US-East, data processing terms “as set out in Schedule 3”, which is not attached, and clause 7.3, which lets Lumenvale use the data “to improve its services”. The transfer checker, working on its own, found Lumenvale is not on the Data Privacy Framework list and there are no standard contractual clauses.
Transfer checker: “I will block any version of this record that lists it without one.”
The attestation coordinator asked Owen two questions, each with its evidence: what is date of birth for, and what is Lumenvale for? He answers a birthday voucher and campaign attribution. The register agent replies that a birthday voucher needs the day and month, not the year, and proposes that the form asks for day and month only and the year is deleted from the 2,870 records. Owen accepts.
“Your answers go into the record as a proposal, cited to you.”
The register agent drafts version 7 with 6 changes, each with its source, in a column beside the record. The transfer checker re-checks version 7 on its own: the US transfer still has no mechanism, so it blocks publishing it as live. It names the safe options for the DPO — pause the pixel until a data processing agreement with SCCs Module 2 and a transfer assessment are signed, or remove it.
Transfer checker: “I re-checked version 7 on my own. The US transfer still has no mechanism, so I block publishing it as live.”
Transfers and new data categories need the DPO. Helena chooses reason code APR-C, approve with conditions: the Lumenvale pixel stays paused until a data processing agreement with SCCs (Module 2) and transfer assessment TIA-2026-031 are signed; birthday is limited to day and month, with the year deleted from 2,870 records by Fri 23 Oct; and the newsletter privacy notice is updated before the pixel runs again. She types her name and confirms she has read the evidence and the checker's view.
“Recorded with your name, the time and the evidence on the audit trail.”
Version 7 is published and transfer assessment TIA-2026-031 is opened. Condition 1 goes to Ritu Chandran, the web platforms owner, to pause tag 41. The register agent proposes the follow-on work to its owners: DPIA screening SCR-2026-361 to the privacy officer, Contact.Birthdate and Lumenvale added to the access-request search map, and a redline of section 3 of the newsletter privacy notice. The breach-scope lookup updates itself: 6,020 subscribers and 21,640 visitors.
Found on Sat 10 Oct, two days after the form changed — not at next March's review.
The drift queue holds 31 items on 23 activities, by severity and due date: interview videos still sent to the US under the 2010 clauses, a wellbeing survey on consent that is now required, a fingerprint template at the Brno plant, a new sub-processor in India. Ana approves low-risk items in bulk within her authority and dismisses a false positive with a reason code; high items go to the DPO.
Reconciler: “This week I opened 12 items on 10 activities and set aside 5 changes that were not drift, with reasons.”
For Kestrel & Vane Services B.V. as at 15 October, the export assembler freezes each activity at its version on that date, checks every Article 30(1) field from (a) to (g), leaves the 2 new drafts out with a note, attaches an evidence appendix and fingerprints the file. 102 activities are ready for the DPO's signature. Nothing is sent to an authority.
“Only the DPO signs.”
The same newsletter record, seen by the five people who keep it true — what their year looked like, and what it looks like now.
Eight agents discover, compare, draft and check each other; owners confirm and the DPO signs.
Reads connected systems nightly — identity provider sign-ins, warehouse schemas, SaaS admin consoles, web forms and tags, supplier records and card expenses — and reports what personal data really flows where.
Reads new and changed contracts, order forms, DPAs and vendor notices: role, sub-processors, hosting, transfer clauses, retention and own-use clauses, each with its page.
Compares each activity's claims with what its systems and contracts show, weekly and on events; opens drift items with a severity, and records what it set aside and why.
Drafts new activities and new versions of changed ones, every value cited with a confidence, and proposes the follow-on work when a version is approved.
Re-derives every transfer on its own: destination, recipient role, adequacy, the Data Privacy Framework list, clause version and transfer assessment.
Tests the lawful basis — consent records, legitimate interests assessments, employee consent, special-category conditions — and stated against observed retention.
Runs the quarterly attestation as short conversations: asks each owner only about what changed, with the evidence; reminds and escalates.
Builds the Article 30 record for a controller as at a date, with an evidence appendix and a fingerprint.
Reason codes, e-signatures. The agents propose; a named person decides.
Ask about any activity, system, vendor or transfer, or say what to do. The agents answer from the register, its versions, the evidence and the contracts, cite every source, and act only when you say so.
What changed in the newsletter record?
Two things the register does not say. Since Thu 8 Oct the signup form asks for date of birth; 2,870 records hold one. Since Fri 9 Oct a pixel sends hashed email, IP address and device ID to Lumenvale Analytics in Virginia, with no transfer mechanism. Owen Pryce has until Mon 19 Oct.
Which transfers have no mechanism?
Three of 132: Lumenvale Analytics (US, newsletter), Harrowgate Talent (US, still on the 2010 clauses), and Parlwell Labs (India, a new sub-processor from 2 Nov).
Is Lumenvale a controller under 7.3?
Clause 7.3 lets Lumenvale use the data “to improve its services”. For that use Lumenvale decides why and how, so it would be a controller, not our processor (Art. 28(3)). The DPA should remove 7.3 or limit it to de-identified data.
Prepare the Article 30 record for Services B.V.
I have set up the record for Kestrel & Vane Services B.V. as at today: 104 activities, 2 of them new drafts that will be left out with a note, and an evidence appendix. Press “Build the record”; Helena Marsh signs it. Nothing is sent.
13 screens from the working solution, on its sample data. Pick one to see it large.
What counts as drift, what needs the DPO and how fast owners answer are settings. The privacy tech admin changes them; each change is a new settings version that takes effect when the DPO approves it.
| Setting | Default | Choose from |
|---|---|---|
| Changes that need the DPO | Lawful basis, a new transfer or mechanism, special-category or criminal-offence data, a new activity, retention longer than stated | Each on or off |
| A new recipient inside the EEA | Off: the privacy analyst approves it | On (the DPO approves) · off |
| Retention counts as drift above | 10% | A percentage you type |
| Propose a change from confidence | 0.85 | A confidence you type, from 0 to 1 |
| Samples read per field, masked | 50 | A number you type |
| Discovery, reconciliation and contracts | Nightly at 02:00 · full reconciliation Sundays at 23:00 · contracts when they arrive | Times and days you type for each |
| Owner confirms a drift item within | 5 business days · reminder on day 3 · escalation to the DPO on day 10 | Days you type for the window, the reminder and the escalation |
| Attestation cycle and digests | Quarterly · analysts' digest daily at 08:00 · DPO summary Mondays at 08:00 | A cycle and times you type |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (GDPR Art. 83(4)(a) — fines up to €10 million or 2% of worldwide annual turnover for infringements of Articles 25 to 39; GDPR Art. 30(1) and 30(4) on the content of the record and making it available on request). People, companies, vendors and systems named on this page are fictional — characters and sample data in the working solution.
Data Mapping and ROPA is data mapping software for privacy teams that builds the record of processing activities from real systems and contracts and keeps it true. Eight agents read your systems, tags and contracts, test every activity's record against them every week, and draft cited corrections; process owners confirm, and the DPO approves and signs the Article 30 record.
The discovery agent reads connected systems every night and contracts when they arrive. The reconciler compares each activity's claims with what the systems and contracts show, weekly and on events, and opens a drift item with the evidence on both sides — or records what it set aside and why. In the demo, the median from a change in a system to a drift item is 1.6 days.
No. The discovery agent reads metadata — fields, tables, tags, settings, record ages — and at most 50 masked sample values per field, and never copies personal data out. The sample limit is a setting.
The transfer checker re-derives every transfer on its own — destination, recipient role, adequacy, the Data Privacy Framework list, the clause version and the transfer assessment — whenever a contract, tag or vendor notice arrives. It cannot see the register agent's reasoning, and it can block a version that lists a transfer with no mechanism until the DPO decides.
No. The attestation coordinator asks each owner only about what changed, with the evidence the agents saw, in a short conversation; owners with no change confirm in one step. A correction becomes a cited proposal with the owner's reason, so nobody retypes it.
Yes. The export assembler builds the record for any controller as at any date from the register's versions, checks every Article 30(1) field, attaches an evidence appendix and fingerprints the file for the DPO to sign. It never sends anything to an authority.
Yes. The agents propose; they never publish a version, close their own drift items, attest for an owner, pause a tag or delete data. Owners confirm, the privacy analyst approves low-risk changes, and the DPO approves lawful-basis, transfer, special-category, new-activity and longer-retention changes with a reason code and a signature. No one approves a version they prepared.
The Agentic Solution Engine builds and deploys it from your requirements and documents — starting from your existing spreadsheet register, which the register agent reads, de-duplicates and maps to the Article 30 fields — and it goes live once every quality gate has passed. We will walk you through it on your own register first.
Every request answered inside its legal clock, with no other person's data released.
1-min demoEU AI Act ComplianceEvery high-risk AI system documented, cited and signed before 2 December 2027.
1-min demoPrivacy Impact AssessmentEvery new project assessed before launch, with each answer traced to its source.
1-min demoWe'll run Data Mapping and ROPA on your own register and a sample of your systems and contracts.